A vulnerability exists in multiple locations that allows for a possible overlay of the installation confirmation dialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege without requiring additional execution privileges. Notably, user interaction is not necessary for exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2025-0080 |
Exploitation
The vulnerability can be exploited by an attacker who can create a malicious application that overlays the installation confirmation dialog. This allows the attacker to trick the user into granting permissions or installing software without their knowledge, as no user interaction is required for the attack to succeed.
Affected Products
- Android OS: The vulnerability affects various versions of the Android operating system, allowing for potential privilege escalation.
Mitigation
To mitigate this vulnerability, users should ensure that their devices are updated with the latest security patches provided by Android. Additionally, users should be cautious when installing applications from unknown sources and consider using security features that limit app permissions.